CVE-2026-21743

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A missing authorization vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow a read-only user to make modification to local users via a file upload to an unprotected endpoint.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

VendorProductVersions
FortinetFortiAuthenticator>= 6.6.0, <= 6.6.6; >= 6.5.0, <= 6.5.7; >= 6.4.0, <= 6.4.11; >= 6.3.0, <= 6.3.5

References

Timeline

Published
Feb 10, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-21757.2A weakness has been identified in D-Link DIR-823X 250416. This vulnerability affects the function sub_420618 of the file /goform/set_upnp. TCVE-2026-217517.4HCL Hive is affected by a cryptographic primitive with a risky implementation which could allow an attacker unauthorized lateral compromise CVE-2026-217527.5HCL Hive is affected by a use of vulnerable third-party components which could allow an attacker unauthorized access or compromise of the syCVE-2026-217534.2HCL Hive is affected by weak software supply chain governance, which could lead to the inclusion of vulnerable, unmaintained, or malicious tCVE-2026-217545.4HCL Hive is affected by multiple infrastructure and network configuration vulnerabilities, which could lead to unauthorized lateral movementCVE-2026-217555.3HCL Hive is affected by a missing rate limit which could allow an attacker unauthorized access via brute-force or credential stuffing attackCVE-2026-217567.2HCL Hive is affected by a broken access control vulnerability which could allow an attacker or unauthorized user to introduce unverified, maCVE-2026-217583.7HCL Hive is affected by an information disclosure vulnerability, which could lead to an attacker gathering sensitive information about the hCVE-2026-217594.3HCL Hive is affected by an information exposure vulnerability where Swagger documentation was found exposed publicly.  Although no sensitiveCVE-2026-21768.8A security vulnerability has been detected in code-projects Contact Management System 1.0. This issue affects some unknown processing of theCVE-2026-217604.6HCL DevOps Loop is affected by an Unauthorized Access to Admin Functionality (Forced Browsing) vulnerability. Improper authorization checks CVE-2026-217615.4HCL DevOps Loop is affected by a Cross-Origin Resource Sharing (CORS) misconfiguration. Improper CORS configuration may allow unauthorized c
CVE-2026-21743: High severity, CVSS 7.2 | Vulnix